You can use our JavaScript SDK to make a request to our endpoint and get the tokens. We don’t have sample code for ASP.NET, but you can refer the sample for other frameworks and implement that using .NET.

https://login.amazon.com/website

Okay, I eventually solved it. I don't know if this is the best way, but it's what I got working, so I'll share what I did for the next person who comes along. Note that I didn't use the MIddleware solutions that almost everybody on the Internet points to, as I could never get one working.

1. Set up the javascript Amazon login stuff described by the login for Amazon page. That was all straightforward.
2. On the last step, Amazon gives you code to copy-paste with a few languages to choose from. None of these languages are C#, but it's just a web service call, so it's pretty easy to adapt. 
3. In the Amazon login javascript, it has a line where you call "amazon.Login.authorize". Change the second argument to the path to a method in your controller where you will put the handling code: Ex:  'https://<your-website>/auth/HandleLogin'. This method will be where the code from step 2 is run.
4. For this last bit, I'm just going to paste my code with heavy comments:

// In practical use, this is probably going to be a class that inherits from IdentityUser
IdentityUser user = new IdentityUser()
            {
//These three values come from the Amazon web service
                UserName = userData.user_id,
                Email = userData.email,
                FullName = userData.name
            };
            
// Check here if you already have the user in the database
            if (_repository.GetUserByUsername(user.UserName) == null)
            {
/* These next few lines are what I spent the most time figuring out. If you don't create a security stamp, you'll get confusing errors when you try to log in. However, because I am not actually managing any passwords in my own web app, I don't actually need the security stamp, as it's purpose is to mark when a user changes their password. The hash below is just a random placeholder value because ASP .NET wants a password, but I'm not actually giving users any way to log in with one. **/
                user.SecurityStamp = new Guid() + user.UserName;
                IdentityResult idResult = await _userManager.CreateAsync(user, SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(new Guid().ToString() + user.UserName)).ToString() + "aA0!");
// You probably want to set up standard roles here.
                await _userManager.AddToRoleAsync(user, "User");
            }
            else
            {
/* I want to keep the user's name around, so I'm saving it with the user, but I also want to update it when a person updates their name with Amazon, so when they log in, I set their FullName in the db to whatever Amazon told me it is.*/`
                _repository.UpdateFullName(user);
                user.SecurityStamp = new Guid() + user.UserName;
                user = _repository.GetUserByUsername(user.UserName);
            }

 // No idea why this next line is required. Doesn't make sense to me, since I thought it was set earlier, but it is necessary to avoid getting a null reference exception
            user.SecurityStamp = new Guid() + user.UserName;
// This is the sign-in method that doesn't require a password. 
            await _signInManager.SignInAsync(user, true, "Login");